InsightCVE
CVE-2026-108883
High

CVE-2026-108883: JeecgBoot editThirdAppConfig Missing Authorization Lets Any Authenticated User Hijack DingTalk, WeCom and Feishu Integrations

By Bhargav Hede Published CVE ID CVE-2026-108883 CVSS 7.1 High
CVE ID
CVE-2026-108883
Severity
HIGH
CVSS
7.1
CWE
CWE-862
Published
October 18, 2026

Summary

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in its editThirdAppConfig handler. The handler modifies third-party application configurations, and the only gate in front of it is authentication: the description states that any authenticated user can perform the modification, with no administrator-level permission check. A low-privileged attacker can therefore replace the client id, client secret, agent id and corp id of the platform's DingTalk, WeCom or Feishu integrations, redirecting directory synchronisation and messaging to attacker-controlled applications or breaking those integrations outright. The published CVSS 4.0 base score is 7.1 (HIGH) — network attack vector, low attack complexity, low privileges required, no user interaction, high integrity impact. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Technical Analysis

CWE-862, "Missing Authorization," describes software that performs a sensitive operation without verifying whether the actor is allowed to perform it. This is distinct from an authentication flaw: the caller must still hold valid credentials, but once authenticated, the authorization layer that should separate ordinary users from administrators is absent. CVE-2026-108883 is a textbook case. The editThirdAppConfig handler in JeecgBoot accepts configuration changes for third-party application integrations, and the description states that "any authenticated user" can perform the modification — exactly the failure mode CWE-862 captures. There is no privilege escalation step, no authentication bypass and no memory-corruption primitive involved; the attack surface is an ordinary API call from an ordinary account.

The affected code is identifiable in the public repository. The source reference points to org.jeecg.modules.system.controller.ThirdAppController inside the jeecg-module-system / jeecg-system-biz module of the JeecgBoot codebase, with the relevant handler located at lines 412–438 of ThirdAppController.java in the referenced commit. The handler name, editThirdAppConfig, and the advisory slug (sys-thirdapp-editthirdappconfig) together indicate a controller endpoint dedicated to editing third-party application configuration, reachable as a sys/thirdApp/editThirdAppConfig-style route.

What the handler controls is the crux. The configuration at stake covers JeecgBoot's integrations with DingTalk, WeCom and Feishu — the platforms the description ties to directory synchronisation and messaging. For these integrations the handler processes the client id, client secret, agent id and corp id: the identifier and credential set that binds a JeecgBoot deployment to one specific application registered on the respective platform. Because the handler lacks an authorization check, a write to these values succeeds regardless of the caller's role, so the binding between the deployment and the registered application can be re-pointed by anyone with an account.

The published CVSS 4.0 vector — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N — matches that picture. The vulnerability is reachable over the network (AV:N) with low attack complexity (AC:L) and no additional attack requirements (AT:N). Exploitation requires low privileges (PR:L), meaning an authenticated low-privileged account, and no user interaction (UI:N). Impact is scored entirely as integrity on the vulnerable system (VI:H), with no confidentiality (VC:N) or availability (VA:N) impact scored and no subsequent-system impacts (SC:N/SI:N/SA:N). Exploit maturity and the remaining supplemental metrics are undefined (E:X and related X values) in the published vector, so no exploit availability is asserted by the score itself.

An integrity-only score can undersell a flaw of this shape. The values an attacker can overwrite are not cosmetic: the client secret and corp id determine which application on the messaging platform the JeecgBoot instance talks to. Per the description, replacing them redirects directory synchronisation and messaging to attacker-controlled applications — organizational data flows to a destination the attacker controls — or breaks the integrations entirely. Note the tension with the vector: breaking an integration is operationally an availability problem for the affected workflows, yet the published vector scores VA:N. Treat VA:N as the scorer's published choice; the description's own wording ("or break them") describes the operational reality.

One structural observation: the vulnerable handler sits in the system module's controller layer, the layer that typically fronts administrative functionality. When a controller method that writes configuration is exposed through the same authenticated surface as everyday user features, the security of the entire integration chain depends on a permission check that, per this CVE, is simply missing. That is what makes CWE-862 findings on configuration endpoints disproportionately severe relative to their apparent simplicity: one absent check converts every account on the deployment into a potential configuration administrator.

Affected Software and Versions

Product: JeecgBoot, an open-source Java project; the referenced source lives in the jeecgboot/JeecgBoot GitHub repository under the jeecg-module-system / jeecg-system-biz module.

Affected versions: all releases through 3.9.5, per the advisory phrasing "JeecgBoot through 3.9.5" — every version up to and including 3.9.5.

Fixed version: none disclosed. The provided sources contain no vendor advisory, patch release or fixed version number; remediation status details are not fully disclosed.

KEV status: false — not listed in CISA's Known Exploited Vulnerabilities catalog per the provided data.

Vendor field: not populated in the provided data; the project repository is hosted under the jeecgboot GitHub organization per the source reference.

Impact

The impact is concentrated on integrity, and the description supports three concrete outcomes:

  • Redirection of directory synchronisation. Replacing the client id, client secret, agent id and corp id of an integration points the synchronisation at an application under the attacker's control. Directory data that would normally flow into the legitimate DingTalk, WeCom or Feishu application instead flows to the attacker's application.
  • Redirection of messaging. The same credential replacement applies to messaging: messages dispatched through the integration are handled by the attacker-controlled application rather than the legitimate one.
  • Breakage of integrations. The description also notes that a low-privileged attacker can simply break the integrations — for instance by writing invalid or unrelated values — disrupting synchronisation and messaging without redirecting them anywhere.

Under the published CVSS 4.0 vector this maps to a high integrity impact on the vulnerable system (VI:H), with no confidentiality or availability impact scored. The blast radius is the third-party integration configuration and everything that depends on it. Nothing in the provided data indicates code execution, privilege escalation beyond the configuration write, or direct data exfiltration from JeecgBoot itself — the described harm is redirection and disruption of the synchronisation and messaging flows.

Exploitation Scenario

The following scenario is illustrative: it is derived strictly from the vulnerability description and does not describe an observed incident.

  1. Obtain a foothold account. The attacker needs any valid, low-privileged user account on a JeecgBoot deployment at version 3.9.5 or below. Because the flaw requires only authentication (PR:L in the CVSS vector), an ordinary staff account suffices; no administrator access is needed.
  2. Send the configuration edit request. The attacker issues a request to the editThirdAppConfig handler — the advisory naming points to the sys/thirdApp/editThirdAppConfig route. Because the handler performs no authorization check, the server accepts the write from this non-administrative session.
  3. Replace the integration credentials. In the request body, the attacker substitutes the client id, client secret, agent id and corp id of, for example, the DingTalk integration with values corresponding to an application the attacker has registered on the messaging platform.
  4. Harvest or disrupt. On the next synchronisation cycle, directory data flows to the attacker-controlled application, and messages routed through the integration are likewise redirected. Alternatively, the attacker writes junk values and the integration simply stops working — the "break them" outcome in the description.

No user interaction, no privileged account and no complex precondition are required — which is why the exploitability side of the CVSS vector is entirely favorable to the attacker.

Detection and Mitigation

Detection

  • Log review: search web server and application logs for requests to the third-app configuration edit route (sys/thirdApp/editThirdAppConfig, per the advisory naming) and cross-reference the authenticated user against administrative role assignments. Any such request from a non-administrator is a strong indicator of exploitation or probing.
  • Configuration audit: compare the client id, agent id and corp id currently stored in the JeecgBoot third-app configuration against the values registered in the corresponding DingTalk, WeCom or Feishu admin consoles. Mismatches indicate the configuration was altered.
  • Behavioural signals: investigate anomalies in directory synchronisation or message delivery around the time of any configuration write — redirected or broken integrations are the described outcomes of abuse.

Mitigation

  • Patching: no fixed version, vendor patch or official remediation is disclosed in the provided sources; details are not fully disclosed. Monitor the jeecgboot repository for changes touching ThirdAppController.java and for any release newer than 3.9.5.
  • Compensating control: until an authorized fix exists, restrict access to the configuration edit route at the reverse proxy, API gateway or WAF layer so that only administrator accounts or administrative network ranges can reach it.
  • Integrity verification: verify and, where necessary, restore the current DingTalk, WeCom and Feishu configuration values, and rotate client secrets if there is any suspicion they were replaced — a secret known to an attacker is a standing credential for the attacker's application.
  • Least privilege: review which accounts hold active credentials on the deployment, since any of them can reach the vulnerable handler while the flaw persists.

Proof-of-Concept: curl and Burp

A public proof-of-concept exists as a Python script, poc_sys_thirdapp_edit_config_post.py, whose filename indicates a POST request against the third-app configuration edit route. The exact parameter names are not fully disclosed in the public description; the fields below correspond to the values named in the advisory — client id, client secret, agent id and corp id — and the route is derived from the advisory slug (sys-thirdapp-editthirdappconfig) and the handler name. Exploitation requires an authenticated low-privileged session, so <AUTH-TOKEN> is a placeholder for whatever credential header the target deployment uses.

curl -k -X POST "http://<TARGET>/sys/thirdApp/editThirdAppConfig" \
  -H "Content-Type: application/json" \
  -H "Authorization: <AUTH-TOKEN>" \
  -d '{"clientId":"<ATTACKER-CLIENT-ID>","clientSecret":"<ATTACKER-CLIENT-SECRET>","agentId":"<ATTACKER-AGENT-ID>","corpId":"<ATTACKER-CORP-ID>"}'
POST /sys/thirdApp/editThirdAppConfig HTTP/1.1
Host: <TARGET>
Authorization: <AUTH-TOKEN>
Content-Type: application/json

{"clientId":"<ATTACKER-CLIENT-ID>","clientSecret":"<ATTACKER-CLIENT-SECRET>","agentId":"<ATTACKER-AGENT-ID>","corpId":"<ATTACKER-CORP-ID>"}

For authorized testing only — test only systems you are permitted to test.

Bug Bounty Angle

For bug bounty hunters and offensive researchers, CVE-2026-108883 is a clean example of a class that pays well: authorization gaps on administrative or configuration endpoints. Practical takeaways:

  • Test with the least privileged account you can obtain. The entire flaw lives in the gap between "authenticated" and "authorized." When a target exposes a configuration API or admin panel, replay every state-changing endpoint with a low-privileged session and compare status codes and responses against an administrator session.
  • Handler names are breadcrumbs. The handler editThirdAppConfig and the advisory route naming give a precise starting point, and a public source repository lets you confirm which endpoints lack permission checks before sending a single request.
  • Severity framing. With CVSS 4.0 7.1 (HIGH) — network reachable, low complexity, low privilege requirement, high integrity impact — this is a report-worthy finding on any program covering the affected product, and it is not in KEV, so it is not already triaged as known-exploited.
  • Test without breaking production. Overwriting third-app configuration on a live instance can disrupt synchronisation and messaging — the very impact described. Where you lack permission to disrupt, validate the missing authorization with a harmless probe (for example, a request from a low-privileged account that returns a success or authorization-specific response) rather than persisting changed credentials, and document the impact path instead.

The public PoC script and the pinned source lines (ThirdAppController.java, lines 412–438) provide verification material if a triager asks for evidence.

Frequently Asked Questions

What is CVE-2026-108883?

It is a missing authorization vulnerability (CWE-862) in JeecgBoot through 3.9.5. The editThirdAppConfig handler lets any authenticated user modify third-party application configurations — replacing the client id, client secret, agent id and corp id of DingTalk, WeCom or Feishu integrations.

Which JeecgBoot versions are affected?

All versions through 3.9.5 are affected per the advisory. No fixed version or patch release is disclosed in the available sources, so the remediation status is not fully disclosed.

How severe is CVE-2026-108883?

CVSS 4.0 base score 7.1 (HIGH), vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N: network-reachable, low attack complexity, low privileges required, no user interaction, high integrity impact with no confidentiality or availability impact scored.

Is CVE-2026-108883 being exploited in the wild?

The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog according to the provided data, and no exploitation-in-the-wild information appears in the available sources.

References

Responsible use: this analysis is published for security research, authorized testing, defensive security and education. Only test or attempt exploitation on systems you are explicitly authorized to assess. Unauthorized access to computer systems is illegal.

Leave a Reply

Your email address will not be published. Required fields are marked *